Azure AD Record updates during Autopilot with Hybrid Join

I was recently asked why when devices get Autopilot registered, an AAD Record gets created with Join type as Azure AD Join, and if that has an impact on the success of a Hybrid Azure AD Join scenario.

Here’s an example when a device is registered but hasn’t run through enrollment/provisioning yet from https://aad.portal.azure.com/. The device record with the purple icon is automatically created with the device serial number during registration.

No alt text provided for this image

Once enrollment has started but before AAD Sync uploads the device from AD, the record becomes enabled and updated with a temporary name:

No alt text provided for this image

Once the domain join profile gets processed but before the sync from AD (before user logs on), the record is updated with the domain join profile naming convention.

No alt text provided for this image

Shortly after Azure AD Connect synchronizes the AD object to AAD (after user logon), the service creates an actual device record with the correct join type.

Purple Icon is always going to be the Autopilot registration record, the one with a computer icon is the device record sync'd from AD with the proper join type.

No alt text provided for this image

To complicate things further there’s also a known issue where if you’re trying to manage a static Device group via Endpoint Management portal, you’ll see duplicate entries because one is the AAD record and the other is the Intune record, but there's no distinction via icons like in AAD portal.

No alt text provided for this image

Either way, that purple Autopilot registration record’s join type doesn’t have any bearing on the success of Hybrid join, it’s just one of Microsoft’s wacky design choices ??.

No alt text provided for this image


要查看或添加评论,请登录

Daniel Davila的更多文章

社区洞察

其他会员也浏览了